@mcp-abap-adt/auth-broker 2.2.0 → 3.0.1

package/dist/bin/mcp-auth.js

@@ -61,6 +61,7 @@ const distPath = path.resolve(__dirname, '..', 'index.js');
 const { AuthBroker } = require(distPath);
 const auth_providers_1 = require("@mcp-abap-adt/auth-providers");
 const auth_stores_1 = require("@mcp-abap-adt/auth-stores");
+const workDir_1 = require("./workDir");
 /**
  * A person completes this login at a browser; the provider's own default
  * (30s) is sized for an unattended caller instead.
@@ -116,6 +117,20 @@ function showHelp() {
     console.log('  --redirect-port <port>  Port for OAuth redirect URI (default: from auth-providers, currently 61001).');
     console.log('                          Must match XSUAA redirect-uris config.');
     console.log('');
+    console.log('SAML (saml2-pure, saml2-bearer; passed to mcp-sso, see mcp-sso --help for all):');
+    console.log('  --idp-metadata <url|path>  IdP SAML metadata (https or file): certificate, entityID, SSO URL');
+    console.log('                             e.g. https://<ias-tenant>.accounts.ondemand.com/saml2/metadata');
+    console.log('  --idp-cert <path>          IdP signing certificate (PEM or DER); repeat for key rotation');
+    console.log('  --idp-entity-id <id>       IdP entityID; the Issuer the assertion must name');
+    console.log('  --idp-sso-url <url>        IdP SSO endpoint (read from --idp-metadata when not given)');
+    console.log('  --idp-initiated            The IdP starts the login; required for saml2-bearer against XSUAA');
+    console.log('  --authn-request-id <id>    AuthnRequest ID an --assertion answers, when sent elsewhere');
+    console.log('  --sp-entity-id <id>        SP entityID, the Audience (saml2-bearer: read from XSUAA metadata)');
+    console.log('  --acs-url <url>            The Recipient (saml2-bearer: read from XSUAA metadata)');
+    console.log('  --saml-metadata <path>     XSUAA SP metadata file; with --service-key <uaa.url>/saml/metadata is read');
+    console.log('  --assertion <base64>       A SAMLResponse obtained elsewhere');
+    console.log('  --assertion-flow <flow>    browser|manual|assertion');
+    console.log('');
     console.log('  --version, -v          Show version number');
     console.log('  --help, -h             Show this help message');
     console.log('');
@@ -126,11 +141,11 @@ function showHelp() {
     console.log('  # OIDC SSO (device/password/browser/token-exchange)');
     console.log('  mcp-auth oidc --flow device --issuer https://issuer --client-id my-client --output ./sso.env --type xsuaa');
     console.log('');
-    console.log('  # SAML2 pure (cookies)');
-    console.log('  mcp-auth saml2-pure --idp-sso-url https://idp/sso --sp-entity-id my-sp --output ./saml.env --type abap');
+    console.log('  # SAML2 pure (cookies); every assertion is validated: see mcp-sso --help');
+    console.log('  mcp-auth saml2-pure --idp-sso-url https://idp/sso --sp-entity-id my-sp --idp-cert ./idp.pem --idp-entity-id https://idp/metadata --output ./saml.env --type abap');
     console.log('');
     console.log('  # SAML2 bearer (in progress, requires --dev)');
-    console.log('  mcp-auth saml2-bearer --dev --service-key ./service-key.json --assertion <base64> --output ./sso.env --type xsuaa');
+    console.log('  mcp-auth saml2-bearer --dev --service-key ./service-key.json --idp-metadata https://<ias-tenant>.accounts.ondemand.com/saml2/metadata --idp-initiated --output ./sso.env --type xsuaa');
     console.log('');
     console.log('  # XSUAA with authorization_code (default, opens browser)');
     console.log('  mcp-auth --service-key ./service-key.json --output ./mcp.env --type xsuaa');
@@ -378,6 +393,12 @@ function runMcpSso(args) {
     }
     process.exit(result.status ?? 1);
 }
+/** The run's private working directory, created on first use and removed on any exit. */
+let runWorkDir;
+function workDir() {
+    runWorkDir ??= (0, workDir_1.createWorkDir)('mcp-auth');
+    return runWorkDir;
+}
 async function main() {
     const rawArgs = process.argv.slice(2);
     const subcommand = rawArgs[0];
@@ -481,9 +502,7 @@ async function main() {
                 console.log('🔍 Detected "credentials" wrapper -> unwrapping to temp file');
                 effectiveJson = json.credentials;
                 // Create temp file with unwrapped content to make it compatible with standard stores
-                const tempDir = path.join(path.dirname(resolvedOutputPath), '.tmp');
-                if (!fs.existsSync(tempDir))
-                    fs.mkdirSync(tempDir, { recursive: true });
+                const tempDir = workDir();
                 const tempKeyPath = path.join(tempDir, `${destination}.json`);
                 fs.writeFileSync(tempKeyPath, JSON.stringify(effectiveJson, null, 2));
                 // Point store to temp directory so it reads the unwrapped file
@@ -547,10 +566,7 @@ async function main() {
             throw new Error('Env file not found and no service key provided.');
         }
         // Create temporary session store (work off a temp copy of env file)
-        const tempSessionDir = path.join(path.dirname(resolvedOutputPath), '.tmp');
-        if (!fs.existsSync(tempSessionDir)) {
-            fs.mkdirSync(tempSessionDir, { recursive: true });
-        }
+        const tempSessionDir = workDir();
         if (envExists && resolvedEnvPath) {
             const tempEnvPath = path.join(tempSessionDir, `${destination}.env`);
             fs.copyFileSync(resolvedEnvPath, tempEnvPath);
@@ -571,7 +587,7 @@ async function main() {
         const brokerServiceUrl = actualServiceUrl || '<SERVICE_URL>';
         const sessionStore = options.authType === 'xsuaa'
             ? new auth_stores_1.XsuaaSessionStore(tempSessionDir, brokerServiceUrl)
-            : new auth_stores_1.AbapSessionStore(tempSessionDir);
+            : new auth_stores_1.AbapSessionStore(tempSessionDir, undefined, actualServiceUrl);
         const sessionAuthConfig = await sessionStore.getAuthorizationConfig(destination);
         let serviceKeyAuthConfig = null;
         if (serviceKeyStore?.getAuthorizationConfig) {
@@ -638,15 +654,29 @@ async function main() {
                     timeoutMs: INTERACTIVE_LOGIN_TIMEOUT_MS,
                 }),
             });
+        // The output file is a self-contained session: whoever reads it refreshes
+        // the token with the UAA credentials it carries, and has no service key.
+        // So this CLI writes the credentials into its temporary session itself —
+        // its own decision about its own output. The broker no longer copies the
+        // client secret into a session store, and without these the refresh token
+        // the login obtains would not be readable back below.
+        if (!sessionAuthConfig) {
+            await sessionStore.setAuthorizationConfig(destination, authConfig);
+        }
         const broker = new AuthBroker({
             sessionStore,
             serviceKeyStore: serviceKeyStore || undefined,
-            tokenProvider,
-        }, options.browser);
+            provider: tokenProvider,
+        });
         console.log(`🔐 Getting token for destination "${destination}"...`);
         const token = await broker.getToken(destination);
         console.log(`✅ Token obtained successfully`);
         const connConfig = await sessionStore.getConnectionConfig(destination);
+        // What the login left in the session, not what was known before it:
+        // `authConfig` came from the service key, which holds no refresh token,
+        // and the refresh token the login obtained went into the session store.
+        // Writing `authConfig` dropped it with the temporary session directory.
+        const savedAuthConfig = (await sessionStore.getAuthorizationConfig(destination)) ?? authConfig;
         if (!token) {
             throw new Error(`Token provider did not return authorization token for destination "${destination}"`);
         }
@@ -655,7 +685,7 @@ async function main() {
         const finalServiceUrl = outputServiceUrl === '<SERVICE_URL>' ? undefined : outputServiceUrl;
         // Write output file based on format
         if (options.format === 'env') {
-            writeEnvFile(resolvedOutputPath, options.authType, token, authConfig?.refreshToken, finalServiceUrl, authConfig?.uaaUrl, authConfig?.uaaClientId, authConfig?.uaaClientSecret);
+            writeEnvFile(resolvedOutputPath, options.authType, token, savedAuthConfig?.refreshToken, finalServiceUrl, savedAuthConfig?.uaaUrl, savedAuthConfig?.uaaClientId, savedAuthConfig?.uaaClientSecret);
             console.log(`✅ .env file created: ${resolvedOutputPath}`);
             // Show what was written
             console.log(`📋 .env file contains:`);
@@ -663,40 +693,33 @@ async function main() {
                 if (finalServiceUrl) {
                     console.log(`   - ${auth_stores_1.ABAP_CONNECTION_VARS.SERVICE_URL}=${finalServiceUrl}`);
                 }
-                console.log(`   - ${auth_stores_1.ABAP_CONNECTION_VARS.AUTHORIZATION_TOKEN}=${token.substring(0, 50)}...`);
-                if (authConfig?.refreshToken) {
-                    console.log(`   - ${auth_stores_1.ABAP_AUTHORIZATION_VARS.REFRESH_TOKEN}=${authConfig.refreshToken.substring(0, 50)}...`);
+                console.log(`   - ${auth_stores_1.ABAP_CONNECTION_VARS.AUTHORIZATION_TOKEN}=<redacted, ${token.length} chars>`);
+                if (savedAuthConfig?.refreshToken) {
+                    console.log(`   - ${auth_stores_1.ABAP_AUTHORIZATION_VARS.REFRESH_TOKEN}=<redacted, ${savedAuthConfig.refreshToken.length} chars>`);
                 }
             }
             else {
                 if (finalServiceUrl) {
                     console.log(`   - XSUAA_MCP_URL=${finalServiceUrl}`);
                 }
-                console.log(`   - ${auth_stores_1.XSUAA_CONNECTION_VARS.AUTHORIZATION_TOKEN}=${token.substring(0, 50)}...`);
-                if (authConfig?.refreshToken) {
-                    console.log(`   - ${auth_stores_1.XSUAA_AUTHORIZATION_VARS.REFRESH_TOKEN}=${authConfig.refreshToken.substring(0, 50)}...`);
+                console.log(`   - ${auth_stores_1.XSUAA_CONNECTION_VARS.AUTHORIZATION_TOKEN}=<redacted, ${token.length} chars>`);
+                if (savedAuthConfig?.refreshToken) {
+                    console.log(`   - ${auth_stores_1.XSUAA_AUTHORIZATION_VARS.REFRESH_TOKEN}=<redacted, ${savedAuthConfig.refreshToken.length} chars>`);
                 }
             }
         }
         else {
-            writeJsonFile(resolvedOutputPath, token, authConfig?.refreshToken, finalServiceUrl, authConfig?.uaaUrl, authConfig?.uaaClientId, authConfig?.uaaClientSecret);
+            writeJsonFile(resolvedOutputPath, token, savedAuthConfig?.refreshToken, finalServiceUrl, savedAuthConfig?.uaaUrl, savedAuthConfig?.uaaClientId, savedAuthConfig?.uaaClientSecret);
             console.log(`✅ JSON file created: ${resolvedOutputPath}`);
             console.log(`📋 Output contains:`);
-            console.log(`   - accessToken: ${token.substring(0, 50)}...`);
-            if (authConfig?.refreshToken) {
-                console.log(`   - refreshToken: ${authConfig.refreshToken.substring(0, 50)}...`);
+            console.log(`   - accessToken: <redacted, ${token.length} chars>`);
+            if (savedAuthConfig?.refreshToken) {
+                console.log(`   - refreshToken: <redacted, ${savedAuthConfig.refreshToken.length} chars>`);
             }
             if (finalServiceUrl) {
                 console.log(`   - serviceUrl: ${finalServiceUrl}`);
             }
         }
-        // Cleanup temp directory
-        try {
-            fs.rmSync(tempSessionDir, { recursive: true, force: true });
-        }
-        catch {
-            // Ignore cleanup errors
-        }
         // Exit explicitly to close any open handles (e.g., OAuth callback server)
         process.exit(0);
     }

package/dist/bin/mcp-sso.js

@@ -20,11 +20,15 @@
  *   # OIDC token exchange
  *   mcp-sso oidc --flow token_exchange --issuer https://issuer --client-id my-client --subject-token <token> --output ./sso.env --type xsuaa
  *
- *   # SAML bearer flow
- *   mcp-sso bearer --idp-sso-url https://idp/sso --sp-entity-id my-sp --token-endpoint https://uaa.example/oauth/token --assertion <base64> --output ./sso.env --type xsuaa
+ *   # SAML bearer flow with a service key: the Audience, Recipient and token alias come from
+ *   # <uaa.url>/saml/metadata, the IdP's trust from its metadata
+ *   mcp-sso bearer --service-key ./service-key.json --idp-metadata https://<ias-tenant>.accounts.ondemand.com/saml2/metadata --idp-initiated --output ./sso.env --type xsuaa
+ *
+ *   # SAML bearer flow, everything stated (IdP-initiated assertion, as UAA/XSUAA require)
+ *   mcp-sso bearer --idp-sso-url https://idp/sso --sp-entity-id <uaa-entity-id> --acs-url <uaa-bearer-acs> --idp-cert ./idp-signing.pem --idp-entity-id https://idp/metadata --idp-initiated --token-endpoint https://uaa.example/oauth/token --assertion <base64> --output ./sso.env --type xsuaa
  *
  *   # SAML pure flow (cookie)
- *   mcp-sso saml2 --flow pure --idp-sso-url https://idp/sso --sp-entity-id my-sp --assertion <base64> --cookie "SAP_SESSION=..." --output ./sso.env --type abap
+ *   mcp-sso saml2 --flow pure --idp-sso-url https://idp/sso --sp-entity-id my-sp --idp-cert ./idp-signing.pem --idp-entity-id https://idp/metadata --cookie "SAP_SESSION=..." --output ./sso.env --type abap
  */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -69,6 +73,8 @@ const auth_providers_1 = require("@mcp-abap-adt/auth-providers");
 const auth_stores_1 = require("@mcp-abap-adt/auth-stores");
 const logger_1 = require("@mcp-abap-adt/logger");
 const mcpSsoConfig_1 = require("./mcpSsoConfig");
+const samlMetadata_1 = require("./samlMetadata");
+const workDir_1 = require("./workDir");
 function getVersion() {
     try {
         const candidates = [
@@ -137,15 +143,28 @@ function showHelp() {
     console.log('');
     console.log('SAML Options:');
     console.log('  --idp-sso-url <url>        IdP SSO URL');
-    console.log('  --sp-entity-id <id>        SP Entity ID');
-    console.log('  --acs-url <url>            ACS URL (default: http://localhost:<port>/callback)');
-    console.log('  --saml-metadata <path>     SAML metadata XML (to resolve token alias)');
+    console.log('  --sp-entity-id <id>        SP Entity ID; also the Audience the assertion must name');
+    console.log('  --acs-url <url>            ACS URL; the Recipient the assertion must name (default: http://localhost:<port>/callback)');
+    console.log('  --idp-cert <path>          IdP signing certificate file (PEM or DER); repeat for key rotation');
+    console.log('  --idp-entity-id <id>       IdP entityID; the Issuer the assertion must name');
+    console.log('  --idp-metadata <url|path>  IdP SAML metadata (https or file): fills --idp-cert, --idp-entity-id');
+    console.log('                             and --idp-sso-url where not given, e.g. https://<ias>/saml2/metadata');
+    console.log('  --idp-initiated            The IdP starts the login; no AuthnRequest is sent (required for bearer');
+    console.log('                             against UAA/XSUAA). Use with --assertion or --assertion-flow manual');
+    console.log('  --authn-request-id <id>    AuthnRequest ID an --assertion answers (SP-initiated, request sent elsewhere)');
+    console.log('  --saml-metadata <path>     XSUAA SP metadata; bearer reads it for the token alias, --acs-url and');
+    console.log('                             --sp-entity-id. With --service-key, <uaa.url>/saml/metadata is read instead');
     console.log('  --relay-state <value>      RelayState (optional)');
-    console.log('  --assertion-flow <flow>    browser|manual|assertion (default: browser)');
+    console.log('  --assertion-flow <flow>    browser|manual|assertion (default: browser; manual with --idp-initiated)');
     console.log('  --assertion <base64>       SAMLResponse (base64)');
     console.log('  --cookie <value>           Session cookies (for pure SAML)');
     console.log('  --token-endpoint <url>     Token endpoint for SAML bearer exchange');
     console.log('');
+    console.log('  Every SAML assertion is validated before use. Both SAML flows require --idp-cert');
+    console.log('  and --idp-entity-id, or --idp-metadata (or idpCertificates/idpEntityId in --config). An --assertion');
+    console.log('  also needs --idp-initiated or --authn-request-id; the browser and manual flows');
+    console.log('  send their own request unless --idp-initiated is given.');
+    console.log('');
     console.log('  --version, -v              Show version number');
     console.log('  --help, -h                 Show this help message');
 }
@@ -246,6 +265,7 @@ function parseArgs() {
     let cookie;
     let uaaUrl;
     let samlMetadataPath;
+    const samlTrust = {};
     const firstArg = args[0];
     if (firstArg && !firstArg.startsWith('-')) {
         if (firstArg === 'oidc') {
@@ -458,6 +478,7 @@ function parseArgs() {
                 i++;
                 break;
             default:
+                i += (0, mcpSsoConfig_1.parseSamlTrustArg)(samlTrust, arg, next);
                 break;
         }
     }
@@ -501,13 +522,9 @@ function parseArgs() {
         cookie,
         uaaUrl,
         samlMetadataPath,
+        ...samlTrust,
     };
 }
-function resolveSamlTokenAlias(metadataXml) {
-    const regex = /<md:AssertionConsumerService[^>]*Location="([^"]*\/oauth\/token\/alias\/[^"]+)"/i;
-    const match = metadataXml.match(regex);
-    return match?.[1];
-}
 async function main() {
     const options = parseArgs();
     if (!options) {
@@ -587,6 +604,9 @@ async function main() {
     // are left alone; the file only fills what they didn't set. A no-op when
     // --config wasn't given.
     (0, mcpSsoConfig_1.applyFileConfig)(options, providerConfigFromFile);
+    // The user's own --token-endpoint, before a service key sets the plain
+    // /oauth/token, which a saml2-bearer grant must not use.
+    const explicitTokenEndpoint = options.tokenEndpoint;
     if (options.serviceKeyPath) {
         const resolvedServiceKeyPath = path.resolve(options.serviceKeyPath);
         const serviceKeyDir = path.dirname(resolvedServiceKeyPath);
@@ -614,19 +634,16 @@ async function main() {
             options.authorizationEndpoint = `${uaaUrl.replace(/\/+$/, '')}/oauth/authorize`;
         }
     }
-    if (options.samlMetadataPath) {
-        const resolvedMetadataPath = path.resolve(options.samlMetadataPath);
-        if (!fs.existsSync(resolvedMetadataPath)) {
-            console.error(`❌ SAML metadata file not found: ${resolvedMetadataPath}`);
-            process.exit(1);
-        }
-        const metadataXml = fs.readFileSync(resolvedMetadataPath, 'utf8');
-        const aliasUrl = resolveSamlTokenAlias(metadataXml);
-        if (!aliasUrl) {
-            console.error('❌ SAML metadata does not contain token alias endpoint.');
-            process.exit(1);
-        }
-        options.tokenEndpoint = aliasUrl;
+    // What the SAML metadata states and the caller did not: the identity
+    // provider's trust from --idp-metadata, and for saml2-bearer the Audience,
+    // Recipient and token endpoint from XSUAA's own metadata (--saml-metadata,
+    // else <uaa.url>/saml/metadata from the service key).
+    try {
+        await (0, samlMetadata_1.applySamlMetadata)(options, explicitTokenEndpoint);
+    }
+    catch (error) {
+        console.error(`❌ SAML metadata: ${error instanceof Error ? error.message : String(error)}`);
+        process.exit(1);
     }
     if (options.protocol === 'oidc' && options.flow === 'password') {
         if (options.uaaUrl && !options.tokenEndpoint) {
@@ -652,10 +669,8 @@ async function main() {
             options.passcode = await (0, mcpSsoConfig_1.readManualInput)('Paste passcode: ');
         }
     }
-    const tempSessionDir = path.join(path.dirname(resolvedOutputPath), '.tmp');
-    if (!fs.existsSync(tempSessionDir)) {
-        fs.mkdirSync(tempSessionDir, { recursive: true });
-    }
+    // Removed on any exit, error and signal included: it holds the secret.
+    const tempSessionDir = (0, workDir_1.createWorkDir)('mcp-sso');
     if (resolvedEnvPath && fs.existsSync(resolvedEnvPath)) {
         const tempEnvPath = path.join(tempSessionDir, `${destination}.env`);
         fs.copyFileSync(resolvedEnvPath, tempEnvPath);
@@ -706,21 +721,20 @@ async function main() {
             refreshToken: existingAuth?.refreshToken,
         });
     }
-    const providerConfig = (0, mcpSsoConfig_1.buildProviderConfig)(options, existingAuth, existingConn);
-    const providerConfigWithLogger = providerConfig.config
+    const withLogger = (config) => config.config
         ? {
-            ...providerConfig,
+            ...config,
             config: {
-                ...providerConfig.config,
-                logger: providerConfig.config?.logger ?? logger,
+                ...config.config,
+                logger: config.config?.logger ?? logger,
             },
         }
-        : providerConfig;
-    const tokenProvider = auth_providers_1.SsoProviderFactory.create(providerConfigWithLogger);
+        : config;
+    const tokenProvider = auth_providers_1.SsoProviderFactory.create(withLogger((0, mcpSsoConfig_1.buildProviderConfig)(options, existingAuth, existingConn)));
     const broker = new AuthBroker({
         sessionStore,
-        tokenProvider,
-    }, options.browser, logger);
+        provider: tokenProvider,
+    }, logger);
     console.log(`🔐 Getting token for destination "${destination}"...`);
     await broker.getToken(destination);
     console.log(`✅ Token obtained successfully`);
@@ -796,12 +810,6 @@ async function main() {
         fs.writeFileSync(resolvedOutputPath, JSON.stringify(outputData, null, 2), 'utf8');
         console.log(`✅ JSON file created: ${resolvedOutputPath}`);
     }
-    try {
-        fs.rmSync(tempSessionDir, { recursive: true, force: true });
-    }
-    catch {
-        // ignore cleanup errors
-    }
 }
 main().catch((error) => {
     console.error(`❌ Error: ${error.message}`);

package/dist/bin/mcpSsoConfig.js

@@ -15,6 +15,9 @@ exports.INTERACTIVE_LOGIN_TIMEOUT_MS = void 0;
 exports.readManualInput = readManualInput;
 exports.normalizeProviderConfig = normalizeProviderConfig;
 exports.applyFileConfig = applyFileConfig;
+exports.readIdpCertificateFile = readIdpCertificateFile;
+exports.resolveIdpCertificates = resolveIdpCertificates;
+exports.parseSamlTrustArg = parseSamlTrustArg;
 exports.buildOidcBrowserConfig = buildOidcBrowserConfig;
 exports.buildOidcDeviceConfig = buildOidcDeviceConfig;
 exports.buildOidcPasswordConfig = buildOidcPasswordConfig;
@@ -22,6 +25,8 @@ exports.buildOidcTokenExchangeConfig = buildOidcTokenExchangeConfig;
 exports.buildSamlBearerConfig = buildSamlBearerConfig;
 exports.buildSamlPureConfig = buildSamlPureConfig;
 exports.buildProviderConfig = buildProviderConfig;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
 const node_readline_1 = require("node:readline");
 const auth_providers_1 = require("@mcp-abap-adt/auth-providers");
 /**
@@ -34,8 +39,17 @@ function readManualInput(prompt) {
         input: process.stdin,
         output: process.stdout,
     });
-    return new Promise((resolve) => {
+    // A closed stdin never answers the question, and a promise that never
+    // settles lets the event loop drain: the process exited 0 with nothing
+    // written, which a script reads as success. End of input is a refusal.
+    return new Promise((resolve, reject) => {
+        let answered = false;
+        rl.on('close', () => {
+            if (!answered)
+                reject(new Error(`no input: stdin closed at "${prompt.trim()}"`));
+        });
         rl.question(prompt, (answer) => {
+            answered = true;
             rl.close();
             resolve(answer.trim());
         });
@@ -103,6 +117,9 @@ const CONFIG_BACKFILL_FIELDS = [
     'assertion',
     'cookie',
     'uaaUrl',
+    'idpEntityId',
+    'idpMetadata',
+    'authnRequestId',
 ];
 /**
  * Backfills `options` in place from a `--config` file's raw `config` object.
@@ -153,6 +170,112 @@ function applyFileConfig(options, fileConfig) {
             options[field] = fields[field];
         }
     }
+    if (fields.idpInitiated !== undefined) {
+        // A string "false" would be truthy and silently declare the opposite.
+        if (typeof fields.idpInitiated !== 'boolean') {
+            console.error("❌ --config: 'idpInitiated' must be true or false.");
+            process.exit(1);
+        }
+        options.idpInitiated = options.idpInitiated ?? fields.idpInitiated;
+    }
+    if (fields.idpCertificates !== undefined) {
+        const raw = fields.idpCertificates;
+        const list = typeof raw === 'string' ? [raw] : raw;
+        if (!Array.isArray(list) ||
+            !list.every((entry) => typeof entry === 'string')) {
+            console.error("❌ --config: 'idpCertificates' must be a string or a list of strings (PEM or base64 DER).");
+            process.exit(1);
+        }
+        // Trust is replaced, never widened: a certificate named on the CLI means
+        // the file's list is not trusted alongside it. A rotated-out certificate
+        // left in the file must not keep verifying assertions.
+        if (options.idpCertificates === undefined &&
+            options.idpCertificateFiles === undefined) {
+            options.idpCertificates = list;
+        }
+    }
+}
+const PEM_CERTIFICATE_BLOCK = /-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g;
+const BASE64_TEXT = /^[A-Za-z0-9+/]+={0,2}$/;
+/**
+ * Reads one `--idp-cert` file into the entries `idpCertificates` takes. A
+ * PEM file may hold several certificates (a rotation bundle); each becomes
+ * its own entry, since a single string is read as one certificate and the
+ * rest would be ignored. A binary DER file (`.cer`, `.der`) is base64-encoded.
+ * Whether the result is a certificate at all is the provider's check.
+ */
+function readIdpCertificateFile(filePath) {
+    const resolved = (0, node_path_1.resolve)(filePath);
+    let content;
+    try {
+        content = (0, node_fs_1.readFileSync)(resolved);
+    }
+    catch {
+        console.error(`❌ IdP certificate file not found: ${resolved}`);
+        process.exit(1);
+    }
+    const text = content.toString('utf8');
+    const blocks = text.match(PEM_CERTIFICATE_BLOCK);
+    if (blocks) {
+        return blocks;
+    }
+    if (text.includes('-----BEGIN') ||
+        BASE64_TEXT.test(text.replace(/\s+/g, ''))) {
+        return [text.trim()];
+    }
+    return [content.toString('base64')];
+}
+/**
+ * The certificates the SAML providers are given: inline ones (a `--config`
+ * file) and those read from `--idp-cert` files. `undefined` when there are
+ * none, so the provider's own `ValidationError` names what is missing.
+ */
+function resolveIdpCertificates(options) {
+    const certificates = [
+        ...(options.idpCertificates ?? []),
+        ...(options.idpCertificateFiles ?? []).flatMap(readIdpCertificateFile),
+    ];
+    return certificates.length > 0 ? certificates : undefined;
+}
+/**
+ * Parses the SAML trust flags into `target`, returning how many values after
+ * `arg` were consumed (0 for a flag with no value, or an argument that is not
+ * one of these). Kept here rather than in bin/mcp-sso.ts so it can be tested.
+ */
+function parseSamlTrustArg(target, arg, next) {
+    switch (arg) {
+        case '--idp-cert':
+            if (!next || next.startsWith('--')) {
+                console.error('❌ --idp-cert needs a certificate file path.');
+                process.exit(1);
+            }
+            // Repeatable: every occurrence adds a certificate, for key rotation.
+            target.idpCertificateFiles = [
+                ...(target.idpCertificateFiles ?? []),
+                next,
+            ];
+            return 1;
+        case '--idp-entity-id':
+            target.idpEntityId = next;
+            return 1;
+        case '--idp-metadata':
+            if (!next || next.startsWith('--')) {
+                console.error('❌ --idp-metadata needs an https URL or a file path.');
+                process.exit(1);
+            }
+            target.idpMetadata = next;
+            return 1;
+        case '--idp-initiated':
+            // A flag with no value. Left undefined when absent, so a --config
+            // file's idpInitiated can still fill it.
+            target.idpInitiated = true;
+            return 0;
+        case '--authn-request-id':
+            target.authnRequestId = next;
+            return 1;
+        default:
+            return 0;
+    }
 }
 function requireOption(value, flagName) {
     if (!value) {
@@ -257,6 +380,9 @@ function buildSamlAuthorization(options) {
             payload: options.assertion,
         });
     }
+    if (options.idpInitiated) {
+        return buildIdpInitiatedAuthorization(options);
+    }
     const assertionFlow = options.assertionFlow || 'browser';
     if (assertionFlow !== 'browser') {
         // 'manual', and an 'assertion' flow given no value, both need a human to
@@ -274,6 +400,34 @@ function buildSamlAuthorization(options) {
         timeoutMs: exports.INTERACTIVE_LOGIN_TIMEOUT_MS,
     });
 }
+/**
+ * An IdP-initiated login has no URL for this CLI to open: the only one
+ * auth-providers can build carries an AuthnRequest, and with `idpInitiated`
+ * it refuses to build one. So the strategy never calls
+ * `buildAuthorizationUrl` — the user starts the login at the identity
+ * provider and pastes the SAMLResponse it posts. The browser flow, which
+ * exists to open that URL, is refused rather than left to fail after the
+ * provider is built.
+ */
+function buildIdpInitiatedAuthorization(options) {
+    if (options.assertionFlow === 'browser') {
+        console.error('❌ --idp-initiated cannot use --assertion-flow browser: there is no request URL to open. ' +
+            'Start the login at the identity provider and use --assertion-flow manual, or pass --assertion.');
+        process.exit(1);
+    }
+    // The ACS the assertion names as its Recipient; the same fallback the
+    // auth-providers strategies use when none is declared.
+    const redirectUri = options.acsUrl ?? `http://localhost:${auth_providers_1.DEFAULT_CALLBACK_PORT}/callback`;
+    return {
+        async authorize() {
+            const payload = await readManualInput('Start the login at your identity provider, then paste the SAMLResponse (from the POST body): ');
+            if (!payload) {
+                throw new Error('No SAMLResponse was provided');
+            }
+            return { payload, redirectUri };
+        },
+    };
+}
 function buildSamlCookieProvider(options) {
     const assertionFlow = options.assertionFlow || (options.assertion ? 'assertion' : 'browser');
     return async (samlResponse) => {
@@ -286,12 +440,25 @@ function buildSamlCookieProvider(options) {
         return readManualInput('Paste session cookies: ');
     };
 }
+/**
+ * What auth-providers 4 validates an assertion against. Absent trust material
+ * is passed as absent: the provider's constructor names what is missing.
+ */
+function buildSamlTrust(options) {
+    return {
+        idpCertificates: resolveIdpCertificates(options),
+        idpEntityId: options.idpEntityId,
+        idpInitiated: options.idpInitiated,
+        authnRequestId: options.authnRequestId,
+    };
+}
 function buildSamlBearerConfig(options) {
     return {
         idpSsoUrl: requireOption(options.idpSsoUrl, '--idp-sso-url'),
         spEntityId: requireOption(options.spEntityId, '--sp-entity-id'),
         acsUrl: options.acsUrl,
         relayState: options.relayState,
+        ...buildSamlTrust(options),
         tokenUrl: options.tokenEndpoint,
         uaaUrl: options.uaaUrl,
         clientId: options.clientId,
@@ -305,6 +472,7 @@ function buildSamlPureConfig(options) {
         spEntityId: requireOption(options.spEntityId, '--sp-entity-id'),
         acsUrl: options.acsUrl,
         relayState: options.relayState,
+        ...buildSamlTrust(options),
         authorization: buildSamlAuthorization(options),
         cookieProvider: buildSamlCookieProvider(options),
     };